Sophos Setup has stopped working (SophosSetup_Stage2.exe)

We have a number of HP thin clients onsite.  Our T630 (Win10) installs wen smoothly but our T620 (WES8) are erroring as above.  Log file below:

Started C:\Temp\sfl-4a383c00\Setup.exe
2019-06-12T11:49:57.8884108Z INFO : Stage 1 command-line options:
2019-06-12T11:49:57.8884108Z INFO : ---
2019-06-12T11:49:57.8884108Z INFO : Quiet mode on: 0
2019-06-12T11:49:57.9040116Z INFO : Automatic Proxy detection disabled: 0
2019-06-12T11:49:57.9040116Z INFO : No feedback mode on: 0
2019-06-12T11:49:57.9040116Z INFO : Dump feedback enabled: 0
2019-06-12T11:49:57.9040116Z INFO : Bypass competitor removal: 0
2019-06-12T11:49:57.9040116Z INFO : Using CRT catalog file path: --
2019-06-12T11:49:57.9040116Z INFO : Only register endpoint with Central: 0
2019-06-12T11:49:57.9040116Z INFO : Log messages between endpoint and Central: 0
2019-06-12T11:49:57.9040116Z INFO : Log command-line passed to executables: 0
2019-06-12T11:49:57.9040116Z INFO : Using custom server: --
2019-06-12T11:49:57.9040116Z INFO : Using custom stage 2 filename: --
2019-06-12T11:49:57.9040116Z INFO : Using cloud user: --
2019-06-12T11:49:57.9040116Z INFO : Using cloud group: --
2019-06-12T11:49:57.9040116Z INFO : Overriding computer name: --
2019-06-12T11:49:57.9040116Z INFO : Overriding computer description: --
2019-06-12T11:49:57.9040116Z INFO : Overriding domain name: --
2019-06-12T11:49:57.9040116Z INFO : Language will be set to: --
2019-06-12T11:49:57.9040116Z INFO : Using message relays: --
2019-06-12T11:49:57.9040116Z INFO : Proxy address: --
2019-06-12T11:49:57.9040116Z INFO : Proxy user name: --
2019-06-12T11:49:57.9040116Z INFO : Using custom customer token: --
2019-06-12T11:49:57.9040116Z INFO : Using specified products: --
2019-06-12T11:49:57.9196110Z INFO : Using certificates from the MCS app data folder: 0
2019-06-12T11:49:57.9196110Z INFO : ---
2019-06-12T11:49:57.9508140Z INFO : Sending HTTP 'GET' request to: full/central/windows/business/installer/latest.tar.gz
2019-06-12T11:49:57.9664114Z WARNING : WinHttpGetProxyForUrl returned: 12180
2019-06-12T11:49:57.9664114Z INFO : Attempting to connect using proxy '' of type 'Empty Proxy'.
2019-06-12T11:49:57.9664114Z INFO : Set security protocol: 00000800
2019-06-12T11:49:57.9664114Z INFO : Opening connection to
2019-06-12T11:49:57.9664114Z INFO : Request content size: 0
2019-06-12T11:49:58.0912131Z INFO : Sending request
2019-06-12T11:49:58.0912131Z INFO : Request sent
2019-06-12T11:49:58.2472143Z INFO : Response status code: 200
2019-06-12T11:49:58.2472143Z INFO : Response data size: 1722651
2019-06-12T11:49:58.2472143Z INFO : trySendRequestThroughPotentialProxy returning response with status code: 200
2019-06-12T11:49:58.2628151Z INFO : Extracting files:
2019-06-12T11:49:58.2628151Z INFO : integrity.dat
2019-06-12T11:49:58.2628151Z INFO : manifest.dat
2019-06-12T11:49:58.2628151Z INFO : rootca.crl
2019-06-12T11:49:58.2628151Z INFO : rootca.crt
2019-06-12T11:49:58.2784152Z INFO : scf.dat
2019-06-12T11:49:58.2784152Z INFO : sof.dat
2019-06-12T11:49:58.2784152Z INFO : SophosSetup_Stage2.exe
2019-06-12T11:49:58.5124163Z INFO : sul.dll
2019-06-12T11:49:58.6684203Z INFO : Management Certs/sophosca1.crl
2019-06-12T11:49:58.6684203Z INFO : Management Certs/sophosca1.crt
2019-06-12T11:49:58.6684203Z INFO : Management Certs/sophosca2.crl
2019-06-12T11:49:58.6684203Z INFO : Management Certs/sophosca2.crt
2019-06-12T11:49:58.6684203Z INFO : Management Certs/Sophos_SHA256_MCS_Root_CA3_exp20380504.crl
2019-06-12T11:49:58.6840190Z INFO : Management Certs/Sophos_SHA256_MCS_Root_CA3_exp20380504.crt
2019-06-12T11:49:58.6840190Z INFO : Management Certs/Sophos_SHA256_MCS_Root_CA4_exp20390504.crl
2019-06-12T11:49:58.6840190Z INFO : Management Certs/Sophos_SHA256_MCS_Root_CA4_exp20390504.crt
2019-06-12T11:49:58.9492204Z INFO : Running setup.
Started C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe
2019-06-12T11:49:59.5732260Z INFO : Stage 2 command-line options:
2019-06-12T11:49:59.5732260Z INFO : ---
2019-06-12T11:49:59.5732260Z INFO : Parent PID: 3684
2019-06-12T11:49:59.5732260Z INFO : Server:
2019-06-12T11:49:59.5732260Z INFO : Message relays: --
2019-06-12T11:49:59.5732260Z INFO : Suppressing feedback: 0
2019-06-12T11:49:59.5732260Z INFO : Dump feedback to disk: 0
2019-06-12T11:49:59.5732260Z INFO : Register only: 0
2019-06-12T11:49:59.5732260Z INFO : Trail logging: 0
2019-06-12T11:49:59.5732260Z INFO : Command-line logging: 0
2019-06-12T11:49:59.5732260Z INFO : Bypassing competitor removal: 0
2019-06-12T11:49:59.5888500Z INFO : CRT catalog: --
2019-06-12T11:49:59.5888500Z INFO : Language: --
2019-06-12T11:49:59.5888500Z INFO : Log files: C:\\ProgramData\\Sophos\\CloudInstaller\\Logs\\SophosCloudInstaller_20190612_114957.log
2019-06-12T11:49:59.5888500Z INFO : User: --
2019-06-12T11:49:59.5888500Z INFO : Group: --
2019-06-12T11:49:59.5888500Z INFO : Quiet: 0
2019-06-12T11:49:59.5888500Z INFO : Virtual appliance: 0
2019-06-12T11:49:59.5888500Z INFO : Proxy address: --
2019-06-12T11:49:59.5888500Z INFO : Proxy user: --
2019-06-12T11:49:59.5888500Z INFO : Overriding computer name: --
2019-06-12T11:49:59.5888500Z INFO : Overriding computer description: --
2019-06-12T11:49:59.5888500Z INFO : Overriding domain: --
2019-06-12T11:49:59.5888500Z INFO : Disable proxy detection: 0
2019-06-12T11:49:59.5888500Z INFO : Customer Token Specified: 2c68bde3-3ae4-486c-af0a-6ef83b9682b4
2019-06-12T11:49:59.5888500Z INFO : Products: all
2019-06-12T11:49:59.5888500Z INFO : Pipe write handle: 1332
2019-06-12T11:49:59.5888500Z INFO : MCS Certificates Folder: 0
2019-06-12T11:49:59.5888500Z INFO : MCS Customer Id: bb4dc497-499e-0478-4979-aeef3b49322e
2019-06-12T11:49:59.5888500Z INFO : Partner Id: --
2019-06-12T11:49:59.5888500Z INFO : Customer Estate Id: --
2019-06-12T11:49:59.5888500Z INFO : ---
2019-06-12T11:49:59.6044324Z INFO : User name: Administrator
2019-06-12T11:49:59.6044324Z INFO : GetUserNameEx/NameDnsDomain: The user name is not available in the specified format. Assuming non-Domain computer.
2019-06-12T11:49:59.6980269Z INFO : User profile loaded
2019-06-12T11:49:59.6980269Z INFO : Model::server value changed to:
2019-06-12T11:49:59.7136277Z INFO : Model::messageRelays value changed to be size: 0
2019-06-12T11:49:59.7136277Z INFO : Model::user value changed to:
2019-06-12T11:49:59.7136277Z INFO : Model::group value changed to:
2019-06-12T11:49:59.7136277Z INFO : Model::parentPid value changed to: 3684
2019-06-12T11:49:59.7136277Z INFO : Model::products changed to: all
2019-06-12T11:49:59.7136277Z INFO : Model::customer token value changed to: 2c68bde3-3ae4-486c-af0a-6ef83b9682b4
2019-06-12T11:49:59.7136277Z INFO : MCS Crts: C:\\Program Files (x86)\\Sophos\\CloudInstaller\\Management Certs\\sophosca1.crt,C:\\Program Files (x86)\\Sophos\\CloudInstaller\\Management Certs\\sophosca2.crt,C:\\Program Files (x86)\\Sophos\\CloudInstaller\\Management Certs\\Sophos_SHA256_MCS_Root_CA3_exp20380504.crt,C:\\Program Files (x86)\\Sophos\\CloudInstaller\\Management Certs\\Sophos_SHA256_MCS_Root_CA4_exp20390504.crt
2019-06-12T11:49:59.7136277Z INFO : MCS CRLs: C:\\Program Files (x86)\\Sophos\\CloudInstaller\\Management Certs\\sophosca1.crl,C:\\Program Files (x86)\\Sophos\\CloudInstaller\\Management Certs\\sophosca2.crl,C:\\Program Files (x86)\\Sophos\\CloudInstaller\\Management Certs\\Sophos_SHA256_MCS_Root_CA3_exp20380504.crl,C:\\Program Files (x86)\\Sophos\\CloudInstaller\\Management Certs\\Sophos_SHA256_MCS_Root_CA4_exp20390504.crl
2019-06-12T11:49:59.7136277Z INFO : Model:: MCS customer id value changed to: bb4dc497-499e-0478-4979-aeef3b49322e
2019-06-12T11:49:59.7136277Z INFO : Sophos Endpoint Defense is not installed
2019-06-12T11:49:59.7136277Z INFO : detectedMsiInstalledMcs.installed: 0
2019-06-12T11:49:59.7292279Z INFO : Beginning command definition.
2019-06-12T11:49:59.7292279Z INFO : Adding competitor detection command.
2019-06-12T11:49:59.7292279Z INFO : Adding command to register with Sophos cloud.
2019-06-12T11:49:59.7292279Z INFO : Adding command to download product suite.
2019-06-12T11:49:59.7292279Z INFO : Adding commands to uninstall existing products.
2019-06-12T11:49:59.7292279Z INFO : Adding command to retrieve policy.
2019-06-12T11:49:59.7292279Z INFO : Adding command to prepare for installation.
2019-06-12T11:49:59.7292279Z INFO : Adding command to install Sophos cloud.
2019-06-12T11:49:59.7448280Z INFO : Command definition complete.
2019-06-12T11:49:59.7448280Z INFO : Stage 1 version:
2019-06-12T11:49:59.7448280Z INFO : Stage 2 version:1.5.70
2019-06-12T11:49:59.7448280Z INFO : OS version: 6.2.9200.
2019-06-12T11:49:59.7448280Z INFO : Service pack: 0.0.
2019-06-12T11:49:59.7448280Z INFO : System Language: 1033.
2019-06-12T11:49:59.7448280Z INFO : User Language: 1033.
2019-06-12T11:49:59.7448280Z INFO : 64 bit: yes.
2019-06-12T11:49:59.7448280Z INFO : FindMainWindow: pid=3684
2019-06-12T11:49:59.7448280Z INFO : Found window for process
2019-06-12T11:49:59.7448280Z INFO : Window is main window of process
2019-06-12T11:49:59.7448280Z INFO : ::EnumWindows stopped early; window found
2019-06-12T11:49:59.7448280Z INFO : _bestHandle=000702EE
2019-06-12T11:50:01.2268628Z INFO : Running System Property Check: VerifyTrust ...
2019-06-12T11:50:01.4608653Z INFO : System Property Check: VerifyTrust - PASSED
2019-06-12T11:50:01.5232644Z INFO : Running System Property Check: HostnameLength ...
2019-06-12T11:50:01.5232644Z INFO : Initialized Winsock subsystem
2019-06-12T11:50:01.5544496Z INFO : Valid hostname length
2019-06-12T11:50:01.5544496Z INFO : System Property Check: HostnameLength - PASSED
2019-06-12T11:50:01.6168460Z INFO : Running System Property Check: GroupNameLength ...
2019-06-12T11:50:01.6168460Z INFO : System Property Check: GroupNameLength - PASSED
2019-06-12T11:50:01.6792471Z INFO : Running System Property Check: IsAdministrator ...
2019-06-12T11:50:01.6792471Z INFO : System Property Check: IsAdministrator - PASSED
2019-06-12T11:50:01.7416469Z INFO : Running System Property Check: PendingReboots ...
2019-06-12T11:50:01.7416469Z INFO : System Property Check: PendingReboots - PASSED
2019-06-12T11:50:01.8040481Z INFO : Running System Property Check: PrimaryDriveSpace ...
2019-06-12T11:50:01.8040481Z INFO : Enough space: 3400 Mb
2019-06-12T11:50:01.8040481Z INFO : System Property Check: PrimaryDriveSpace - PASSED
2019-06-12T11:50:01.8664486Z INFO : Running System Property Check: MsXml ...
2019-06-12T11:50:01.8820467Z INFO : System Property Check: MsXml - PASSED
2019-06-12T11:50:01.9444649Z INFO : Running System Property Check: NotFirewall ...
2019-06-12T11:50:01.9444649Z INFO : System Property Check: NotFirewall - PASSED
2019-06-12T11:50:02.0068675Z INFO : Running System Property Check: NotHitmanProAlertIncompatible ...
2019-06-12T11:50:02.0068675Z INFO : No HitmanPro.Alert Installed
2019-06-12T11:50:02.0068675Z INFO : System Property Check: NotHitmanProAlertIncompatible - PASSED
2019-06-12T11:50:02.0692693Z INFO : Running System Property Check: NotInvincea ...
2019-06-12T11:50:02.0692693Z INFO : System Property Check: NotInvincea - PASSED
2019-06-12T11:50:02.1316685Z INFO : Running System Property Check: NotMessageRelay ...
2019-06-12T11:50:02.1316685Z INFO : RMS is not installed on the endpoint
2019-06-12T11:50:02.1316685Z INFO : System Property Check: NotMessageRelay - PASSED
2019-06-12T11:50:02.1940703Z INFO : Running System Property Check: NotNac ...
2019-06-12T11:50:02.1940703Z INFO : System Property Check: NotNac - PASSED
2019-06-12T11:50:02.2564694Z INFO : Running System Property Check: NotPatch ...
2019-06-12T11:50:02.2564694Z INFO : System Property Check: NotPatch - PASSED
2019-06-12T11:50:02.3188501Z INFO : Running System Property Check: NotPureMessageDomino ...
2019-06-12T11:50:02.3188501Z INFO : System Property Check: NotPureMessageDomino - PASSED
2019-06-12T11:50:02.3812704Z INFO : Running System Property Check: NotPureMessageExchangeWithAntiSpam ...
2019-06-12T11:50:02.3812704Z INFO : System Property Check: NotPureMessageExchangeWithAntiSpam - PASSED
2019-06-12T11:50:02.4436729Z INFO : Running System Property Check: NotSharePoint ...
2019-06-12T11:50:02.4436729Z INFO : System Property Check: NotSharePoint - PASSED
2019-06-12T11:50:02.5060556Z INFO : Running System Property Check: NotSecServer ...
2019-06-12T11:50:02.5060556Z INFO : System Property Check: NotSecServer - PASSED
2019-06-12T11:50:02.5684766Z INFO : Running System Property Check: NotSum ...
2019-06-12T11:50:02.5684766Z INFO : System Property Check: NotSum - PASSED
2019-06-12T11:50:02.6308552Z INFO : Running System Property Check: NotBlockedByTamperProtection ...
2019-06-12T11:50:02.6308552Z INFO : Not tamper protected
2019-06-12T11:50:02.6308552Z INFO : System Property Check: NotBlockedByTamperProtection - PASSED
2019-06-12T11:50:02.6932537Z INFO : Running System Property Check: RAMSize ...
2019-06-12T11:50:02.6932537Z INFO : System Property Check: RAMSize - PASSED
2019-06-12T11:50:02.7556555Z INFO : Running System Property Check: SupportedOS ...
2019-06-12T11:50:02.7556555Z INFO : Running on workstation.
2019-06-12T11:50:02.7556555Z INFO : System Property Check: SupportedOS - PASSED
2019-06-12T11:50:02.8180546Z INFO : Running System Property Check: ValidTempDirectory ...
2019-06-12T11:50:02.8180546Z INFO : Temp folder exists.
2019-06-12T11:50:02.8180546Z INFO : System Property Check: ValidTempDirectory - PASSED
2019-06-12T11:50:02.8804750Z INFO : Running System Property Check: ValidServer ...
2019-06-12T11:50:02.8804750Z INFO : System Property Check: ValidServer - PASSED
2019-06-12T11:50:02.9428679Z INFO : Running System Property Check: ValidDeploymentInfo ...
2019-06-12T11:50:02.9428679Z INFO : Current Time: 2019-06-12T11:50:02.942000
2019-06-12T11:50:02.9428679Z INFO : This computer is part of the workgroup: WORKGROUP
2019-06-12T11:50:02.9428679Z INFO : Domain Name: WORKGROUP
2019-06-12T11:50:02.9428679Z INFO : Computer Name: HPHEWLE-948R3U7
2019-06-12T11:50:02.9428679Z INFO : Computer Description is not available.
2019-06-12T11:50:02.9428679Z INFO : Operating System: WIN8
2019-06-12T11:50:02.9428679Z INFO : ProductType: 65
2019-06-12T11:50:02.9584578Z INFO : Last logged on user was: HPHEWLE-948R3U7\\Administrator
2019-06-12T11:50:02.9584578Z INFO : Fully Qualified Domain Name: HPHEWLE-948R3U7
2019-06-12T11:50:02.9584578Z INFO : Processor architecture: x64
2019-06-12T11:50:02.9584578Z INFO : OS Major Version: 6 and OS Minor Version: 2
2019-06-12T11:50:02.9584578Z INFO : Friendly OS Name: WIN8
2019-06-12T11:50:02.9584578Z INFO : Is server?: 0
2019-06-12T11:50:02.9740559Z INFO : Sending HTTP 'POST' request to: sophos/management/ep/install/deployment-info
2019-06-12T11:50:02.9896560Z WARNING : WinHttpGetProxyForUrl returned: 12180
2019-06-12T11:50:02.9896560Z INFO : Attempting to connect using proxy '' of type 'Empty Proxy'.
2019-06-12T11:50:02.9896560Z INFO : Set security protocol: 00000800
2019-06-12T11:50:02.9896560Z INFO : Opening connection to
2019-06-12T11:50:02.9896560Z INFO : Sending request for connection confirmation through potential proxy
2019-06-12T11:50:02.9896560Z INFO : Request content size: 0
2019-06-12T11:50:03.1456579Z INFO : ValidateFileCertificateCheck: Validate certificate against file on WINHTTP_CALLBACK_STATUS_SENDING_REQUEST
2019-06-12T11:50:03.1456579Z INFO : Certificate check succeeded
2019-06-12T11:50:03.1456579Z INFO : ValidateFileCertificateCheck: Ignore WINHTTP_CALLBACK_STATUS_REQUEST_SENT
2019-06-12T11:50:03.1768595Z INFO : Response status code: 200
2019-06-12T11:50:03.1768595Z INFO : Response data size: 168
2019-06-12T11:50:03.1768595Z INFO : trySendRequestThroughPotentialProxy returning response with status code: 200
2019-06-12T11:50:03.1768595Z INFO : Request content size: 1113
2019-06-12T11:50:03.1768595Z INFO : ValidateFileCertificateCheck: Validate certificate against file on WINHTTP_CALLBACK_STATUS_SENDING_REQUEST
2019-06-12T11:50:03.1768595Z INFO : Certificate check succeeded
2019-06-12T11:50:03.1924774Z INFO : ValidateFileCertificateCheck: Ignore WINHTTP_CALLBACK_STATUS_REQUEST_SENT
2019-06-12T11:50:03.2080591Z INFO : ValidateFileCertificateCheck: Validate certificate against file on WINHTTP_CALLBACK_STATUS_SENDING_REQUEST
2019-06-12T11:50:03.2080591Z INFO : Certificate check succeeded
2019-06-12T11:50:03.2236592Z INFO : ValidateFileCertificateCheck: Ignore WINHTTP_CALLBACK_STATUS_REQUEST_SENT
2019-06-12T11:50:03.2236592Z INFO : Response status code: 200
2019-06-12T11:50:03.2236592Z INFO : Response data size: 239
2019-06-12T11:50:03.2236592Z INFO : Parsing message received for deployment token: {"products":[{"product":"DEVICE_ENCRYPTION","supported":false,"reasons":["UNLICENSED"]},{"product":"INTERCEPT_ADVANCED","supported":true,"reasons":[]}],"registrationToken":"55187cc9209ed99069316ef08dd7af882f14b9c2eba04d340d3d0c59ac364f97"}
2019-06-12T11:50:03.2236592Z INFO : Model::token value changed to: 55187cc9209ed99069316ef08dd7af882f14b9c2eba04d340d3d0c59ac364f97
2019-06-12T11:50:03.2236592Z INFO : Licenses available: INTERCEPT_ADVANCED
2019-06-12T11:50:03.2860590Z INFO : Running System Property Check: InstallationInProgress ...
2019-06-12T11:50:03.2860590Z INFO : System Property Check: InstallationInProgress - PASSED
2019-06-12T11:50:03.3484615Z INFO : Running System Property Check: SafeGuardEncryption ...
2019-06-12T11:50:03.3484615Z INFO : Entered installedProductCode, upgradeCode={BA2F47D3-1C17-40E7-8DE7-1CD733442B6C}
2019-06-12T11:50:03.3484615Z INFO : Product is not installed
2019-06-12T11:50:03.3484615Z INFO : licensesContainFeature(DEVICE_ENCRYPTION): false
2019-06-12T11:50:03.3484615Z INFO : System Property Check: SafeGuardEncryption - PASSED
2019-06-12T11:50:04.3312719Z INFO : Starting installation process.
2019-06-12T11:50:04.3312719Z INFO : About to execute command: CompetitorDetector
2019-06-12T11:50:04.3624687Z ERROR : Controller::Install failed: Could not connect. Error code = 0x8004100e\n
2019-06-12T11:50:56.7431913Z INFO : Cleaning up extracted files
2019-06-12T11:50:56.9615978Z ERROR : Exception: ReadFile failed: 109 


Logged in and running as Administrator, Firewall and Defender are switched off.  Process Monitor logfile here: Process Monitor Log

Any thoughts appreciated.


  • Hello  

    Did some research and found some issues with the same error code.

    2019-06-12T11:50:04.3312719Z INFO : About to execute command: CompetitorDetector
    2019-06-12T11:50:04.3624687Z ERROR : Controller::Install failed: Could not connect. Error code = 0x8004100e\n

    See if this would help:

    It could be that a WMI repository is missing, which the installer is dependent on, and causes the install to fail.
    To check this: launch wmimgmt.msc, go to the properties of your WMI Control to see browse for Namespaces.

    - Our installer is apparently trying to call "SecurityCenter2" from WMI. 
    - You can check the following to see if it's missing on the machine.

    Run: Winmgmt /resetrepository, which will rebuild the WMI repository, potentially adding SecurityCenter2 if it was missing. Reboot, and try re-running the installer, 
    If this works then for Windows 8 Embedded machines, would be to incorporate the SecurityCenter2 repo into the OS image on deployment. 


    If the issue persists, please raise a Support case, in some cases an alternative installer could be provided as a workaround.

  • In reply to DianneY:

    Hi DianneY,

    Many thanks for the reply. You were right in that the thin client was missing the SecurityCenter2 from WMI.  I rebuilt the WMI repository but unfortunately SecurityCenter2 did not surface.  I then checked one of our T630 (Win10) clients and the repo was present so exported/imported the WMI repository.  This got me past the initial error and allows the installer to download and initialize but then completes after 10 minutes with a failure (and to reboot).  Upon reboot, it appears the Sophos interface is present but reports 'Some Sophos services are not running'.  The log file fails with ERROR : Exception: Setup program failed with code: 1 (full log file below).  The Sophos client Events tab shows (after a reboot) that 'Competitor software removal failed with code: 14'.  This was a HP image with not AV software previously installed.  I will log a call with Support as you recommended but thought I would post here also in case you had any further ideas.

    Thanks for your help.



    Edited by @ruckus as log file was triggering moderation filter.  Please post long log extracts as an attached txt file to improve readability.

  • In reply to T C:


    Great that our previous suggestion got you to move further, thanks for the feedback.

    See if the information in avremove.log will help. Check out this article for more information.

  • In reply to DianneY:

    Hi DianneY,

    Apologies, I did check Sophos Central for the affected thin client and saw "Failed to install Sophos Anti-Virus for Windows: 80041f18." and "Failed to install savxp: 80041f18" so came across that very same document advising to check Windows\Temp\avremove.log but it was not present.



  • In reply to T C:


    You can also try %localappdata%\temp\avremove.log if it exists.

    Since Sophos Antivirus is failing to install based on the CloudInstaller log, you can check for any Sophos Anti-Virus Install log or Sophos Anti-virus CustomActions log in that same location to see what error is coming up in the logs.